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(57) Abstract: A packet tracing system capable of tracing a packet even by using an existing network device. Packet printing devices 
(la, lb and lc) create hash values from all the packets flowing in a network to be monitored, and stores the created hash values in a 
storage unit. An IDS (3) detects a questionable packet in the monitored network. On receiving a warning and a packet to be traced 
from the IDS (3), a management system (2) creates the hash value of the packet and transmits a search request containing the created 
hash value to the packet printing devices (la, lb and lc). These devices (la, lb and lc) search the storage unit and transmit the 
results to the management system (2). This system (2) acquires the route of the traced packet from the results of the search and the 
construction information on the network. 
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irJSt, IE5l&Adry h©iI#jfi*T£fcH. £©£ 5 7 t j:^jS7C©^$nfc/^°^^ 
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25 •*J\y>'3.^tLTMW-?2>. 
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»g->X-rA2«, *y h»7-^©«^filSSrBBtebTfe?), IDS3tifi8 
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IDS3^\ *y h7-^C^tWy h&^ftlbfcfc©^^ ID 

S3H M£, h$fIyXTA2l:Iit§ 0 
flyXfA2it I DS 3^?>©«#g£:, &mttM<D/Vry b SgflTfS £, 

*tf/^y h-r-^O— -f&M, SfLfc/^v § z 

t ifi T * * 5* - * TP & n teffa T? «b cfc ^ o 

fIyXfA2H, A*3r»/ h^U >^ >#mm 1 ©M£5t§g U * 

/^7b7''J>f^>^glla 1 lb, led §fiU&Ayya§i-|[ 
15 5/*'rA2k:aHrr*. 



fiyXfA2}l Adry h^U>f^>^ll a, lb, lc*^Ii$ 

^'J>f^>^f 1 (la, lb, 1 c) 0rtffi*j£&tt!tB&WLT^Lfc:/ 
□ B3H A* fry h^U >f^>^Sf 1 ©HHf ^M^Sfe© 

t^. Afry h^U >^ggl WKjf££, H 2 , EI 3 
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5 1 2 »7°U >5V >ifM'MffiT$>Z>o 7V >v-4 >ifWm 1211 * 6*>D 
Ar>aIS^t§^ A^r >y h:7°'J >tV >^ 

1 3 fCtt^bT&< 0 
13(1 Ay>yhyj>f^>^TS§. A£-y h-/U >>fMl 3te, 

10 gl fcf— Lfc/^y b<D/\y i/a«44)Jt5 (H3C*^5S6 2) . 

fclB1ft$nTVi5Ay>a.fiO* (flft) Zmm-fZ (H3t*(t«S6 3) . 

15 (0 3 KfcWSS 6 4) o ^t-r>aSl5l:E#§nT^§A>r>a 

i^-)li£tT-eS^fci^ ^tr>^l!Wl4(l s> 5 fcK 

s/^afWfflfiB 1 4tt, ^t-yyagEl 5 CE1t*nTVi*A 

20 ^W^ttt, Stt/tiry hOf^^tTTL (Time To Live) WRIbT^S. 

-f AX*>yt, TTLt$il#^t7ya^l 5 <D£^W<g>:7V 
F<SK:3Blfc;*i*5 (B3fc*^5S6 5) . 

fi^7h7-i?i:IPi^tl, fiyXfA2tiitS„ ii»x-^x> 
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n>xv hy'V >?-4 >#mmi ©#fc*ft"3#nfc^. 

si$nt^§ r ds 3frttmtnniry b\zM-rzmm*%:m?z>. 2 2 
5 \*n*ry hs«ajT*o, ftasnx^a i ds 3a>s*iEfcA$-y hssirr 

So 

(^r>aK») £, A^y h7U >5V >^B&2 4 fc»*l/T*<. 

n*r*j b7V >5V >^g 1 ©yu >^f&HHffisi 2T?^tsn5^S 
10 f A 2 ij >f ^ >^«»» 2 3T»£3tt*#5£tt#fc|PJDT 

2 4«A*-y h 7 U 0 , ^'J >^tf»fiP2 3Ci^$ 

tlfc^rS: (Ay^iHIfc) A$-y HM«2 2 #gig LfcA^ry h©Ay> 
2 5 t±36tt*ft«T?* A$-y h^U >^>f >^«2 4T4 
15 ^$n&A>r>aI^^W$§#/^y h^U >f ^ >^ill a, 1 b, 

fclBttfSDB (-x-^^-X) 2 7 «jilM£B&fej&8B*ea 0 , A£*y 

h^J>T^^ila, lb, 1 c^P-liStlfct^t, MS2 
20 6 0fit*6, A^y hCDSMg^ffr&TSo 

Ef5fc&^T, 5 1, 5 2 !i I S P (Internet Service Provider) T&Z* 3 

25 I SP 5 1, 5 2, it- A3 5«, &*;W-*3 1 , 3 2, 3 3 ZftLT^m 

^3 1, 3 2, 3 3ifi&MZtlXKZ*y h7~2\Z, /^-yh7°'J>r 
-Y>^SlSla, lb, 1 c*SftttSnTVi*. A dry b7V >5^ >ifmUl 
a, lb, 1 c tt, 3 1 , 3 2, 3 3 L&MZtlTU&Zy hV — tr&m. 
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a, lb, lcit NTPM (Network Time Protocol) fc«fctK l*lMfr©P$ 
SO § HO 89 tS T H -5 © <h f 5 o 
5 IDS 3ttU— A3 5 ^SMKSft'Oi* I D S 3 ttlf- A 3 5 © 

^/^yhSiill^S. fIyXfA2(i IDS3tifitb, 

/^*;h^J>f^>^tla, lb, lc, fi^XfA2, IDS3I1 

10 I DS 3*«, Tfmi&Wry h*t-/t3 5^^tfflbfcttS„ ID 

S3H M:»tSti*f IJ'XtA 2 teSSHt*. fiy^f 

fct, StOM*t&ofc/^y hOlUS I D S 3 CS*f5. 
*ttSS 71). 

->a«ft) A$r y h7°U >^ >^2 4fciSUT*<. ^yh^J> 

20 2 3 iCfiSSnfcAy y aMR^ffl y aI64j$t5 (06 

fcWSS 7 2) 0 

ii«^$2 5«, ft/$fflr$2 6$#Il, /tv-y >tV >^gll © 

tt*S**Slfl|f S A^ry b7°U >if^W 1 
(06 m«S 7 3) „ K h7*'J >f^ >^gf 1 (D» 

25 Sf>&V>$^ MW2 5H, ia<}C*§-r^T©/1^y h7°U>T-^>^S 
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AITS (H6lC*Jt«S 7 4) . S#X-5>x>h»l 6tt, 

T4>#mmi c®j|*I-yi>h§l!l 6 feu Av>a.fil4:Kii#W-e>nT8B 

A^yh^iJ>f-f >i^Stlc^5, r^j 

(H6 Kismss 7 7) „ 

m/x^-i±2(Dmm$iU2 5 a, «fi2 6s#iu A^h 

8) . ^-®^m©$gm, jSfcB UTV>fcVV^y h"7°U >tV >^ 
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5 XxA2©ii«2&g|$2 5«u ±}£UfcAdry h:/U >t-^ >^SIl©ti$: 
fxV», Adry ^ij>r-f>i?ifil at^L^M*&^ffT§o 
A dry h^U ate, =^y->a.g&l 5 *|ft*U ttft&&flf 

Adry h7°'j a^s, rjtcj tv^tts8i|g*ss<iL&fi 

10 vX^A2©Ml«{&Mg|$2 7te, Adry h^U>T^>^ll c^SAdr 

*y h7"^fl^'\(Dl/*-hfcLTiat5c ^F^&Adry h©M^ 
^A^ry h7°'J >5V yZrmW.1 CJ^SAdry h7°U >tV >^ggl a©r^T 
S>5ui^6, ^H&Adry Mil S P5 lfrt>mtch<DtmmT°%Z>, 

v-z'gmmit* i sp 5 KommmK.m&'rzt&EhT. ^mw^y b\z% 

20 TZttf&&fI'DZ£fifT!t%. 

fcfc, »^1f $g 2 6 ©'If ft, &3^teAdry h7>J>T^ >^S« 1 

25 *V\'r>aI&4M5©Mt5^ (Ay~>3.ii5i&) iiMD5ltfeJ;< l 
1 . !W|-© A dry h(Dm-B 

DoStl (Denial of Service) ^tfh ©Adr y h Sr^cSfc^jf f 
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§^ * WO A ^ y h <D A y i/ a fit tt 1*3 - 1 & & . 

/^^yj>f^ >^s«ittiefiBo^s:TAy>afii*^figLT^s. ng 

10 -OAu/Vnffi^jg^UT^LT^S^flJ^fbfc*^ &&£j&b&ft--©A 
2. )\>Ty h©fg<£ 

M^s -a®^l/-i/3>l:it5f-^}l «»©Adr y Ml#§!!£ft, 

ess 3*1*. zcD£5iZs femzfrmznrc/vry h%m&L, ^znitAt- 

(D ISiJSfj , TTTLJ > rAy^iy^-tJ-Aj /^^fttjS 

±$ l , 2 Ay S'jiWftCD/ty x— 5/g >%%m-$-%z\t\z£Z>, 

25 A^ry hy°U >~tV >ifmm.l(0^^y^^mi 5 0M*/.N£<t" *Cl£rt«Rr 
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*^3 4, 3 5ti«4ft5. «F^l-l~7tt, h <7-^ NfC 

- 1-7 te, im**j F7-^^LTf|yX7A2^n§. 

(a) iTC/^-> hyj >x-f >^gSC^LTiW&Mt§«^ 
§1^X^2(1 IDS 3*6i»*n&/^y K#^M&^£?^M* 

SflfS^y h>7 — ^7^^LT, ±T©/1£-y hyij>r^ >^iSl - 1~7^\ 
10 ^Oi«$^|tfc/^7 h^U >x-r >mi - 1 ~7«u ft 

(b) i Dscffiw^ h-7°u >^ >?mw<Dwz$iisTmmm$i%mm 

15 £fFS*y h7-^§^bT, I DS 3 ©ittifi©/^ y h7°U >^S«1 

20 1-2, i-4«, mmMMoAiry h^mmo^mm^, z<D&mm&* 

mm Is ft K try h7°V>7-4 >//mWl - 5lZttLTW®T& a fbT, A^ry 

h7°u >t-^t >^sai -l, 1-2, i -4©^n^n«, SBrtt^js^^ 

^b7'U>f0^gil-3, 1-6, 1 - 7Mfc$RgJfc&2Mrr*. £© 
25 ttf££**t)3gLfT:5C£K:<kt), &3f*f*©A°^y h©MHg&£iij$U A^r 
y h-7'U>7V >y^g 1 - 5 t)mmm$k*t <0 SifeTflyXfA 2 -x^ff 
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5 h^-^S^LT, IDS 3©jSjfi©Adry h^U >t^ >ifgfi 

ski - 5rtfc**s**oAiry hftfemmsmmztiT^rcm&ofr, £e>ic, 
ski - 5©tai£-r§^g(iMLT^^^fft'\ M«is^^^ffT-5o 

5^H^StLT#ffi-r§ ! b©iLfco LfrU Cinicl&SttSfrfrTft < . A^ 
20 y h^'J >^ >^SKl©$l»x-5?x>M»l 6Wu ia»**yh7-^ 
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±m<D*mMBMT?U, n>rv b-?V>T<(>#mmi a, lb, lc 
ft, NTPIfl (Network Time Protocol) ftWlf ©&#£!!£ M£ -ft t 

A fry httJfcflMRfcfc/^fry h^iJ^^SIl a, lb, left 
fc^TfBISLT&i*, "M«t:#/^^^iJ>f^>^lla, lb, 

Tfeiv^ £©t£, -%.mmz$zmm*y M7-£*a»T*/tfrs/ h*£ 

10 JMIoT**, &A°fry h^ij>f^>^ll a, lb, iclcft Ulifc^ 

*fc, h?V>v?4>?m*l a, lb, lcit /Ifry MfrJgflW 

S!B«-rs«^fc, Afry hS3a^J&^t)*TjE«T*«t5fcLT, fiyX 

©aawrtu fc < ttsROTft t & * fc » fc , icm ft b# m ft ij m -r § c t 

^ry^U>T^>^gila, lb, 1 cftlOEt^TJS^fc/Tfry K#£fif 

££, §/^>^^'J>fO»la, lb, lclt IDS3©»H& 
*bTV>TfeJ;H. cntCtO, Mv^^A 2 /^£©M)£K:X^< ©!?«&<, 
25 g£>^&A°fry hStfcfflU Wi/^y hjWtftffl^nfc^jftTffai^^T-A 
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WE/t^-v hyu>f^f >tfmm±. 

ME 5/ * t- A rt> 6 ©3?2$ * § Tifl =y X ^ A £ 31ft $ tlfc A y b 
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